Date: Wed, 18 Feb 2004 14:18:59 +1100 (EST) From: Bruce Evans <bde@zeta.org.au> To: current@freebsd.org Subject: standard error handling for malloc() broken for user root and group wheel Message-ID: <20040218140756.S20006@gamplex.bde.org>
next in thread | raw e-mail | index | archive | help
User root and group wheel cannot get standard error handling for malloc()
even if they specifically asked for it using MALLOC_OPTIONS=a or
equivalent. This was broken in rev.1.73 of malloc.c. Fix:
%%%
Index: malloc.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdlib/malloc.c,v
retrieving revision 1.84
diff -u -2 -r1.84 malloc.c
--- malloc.c 28 Nov 2003 18:03:22 -0000 1.84
+++ malloc.c 16 Feb 2004 18:38:36 -0000
@@ -411,5 +411,5 @@
const char *p;
char b[64];
- int i, j;
+ int i, j, malloc_a;
int save_errno = errno;
@@ -420,4 +420,5 @@
#endif /* MALLOC_EXTRA_SANITY */
+ malloc_a = 0;
for (i = 0; i < 3; i++) {
if (i == 0) {
@@ -438,6 +439,6 @@
case '>': malloc_cache <<= 1; break;
case '<': malloc_cache >>= 1; break;
- case 'a': malloc_abort = 0; break;
- case 'A': malloc_abort = 1; break;
+ case 'a': malloc_abort = 0; malloc_a = 1; break;
+ case 'A': malloc_abort = 1; malloc_a = 0; break;
#if defined(MADV_FREE)
case 'h': malloc_hint = 0; break;
@@ -469,9 +470,16 @@
/*
- * Sensitive processes, somewhat arbitrarily defined here as setuid,
- * setgid, root and wheel cannot afford to have malloc mistakes.
+ * Sensitive processes, somewhat arbitrarily defined here as setuid
+ * and setgid ones, cannot afford to have malloc mistakes.
*/
- if (issetugid() || getuid() == 0 || getgid() == 0)
- malloc_abort = 1;
+ if (issetugid())
+ malloc_abort = 1;
+
+ /*
+ * Also, abort on malloc mistakes for root and wheel unless the user
+ * has explicitly asked not to.
+ */
+ if (malloc_a == 0 && (getuid() == 0 || getgid() == 0))
+ malloc_abort = 1;
UTRACE(0, 0, 0);
%%%
Related unfixed bugs:
- the special handling for sensitive processes is not documented in malloc.3.
- the special handling for sensitive processes doesn't work in all cases.
Processes may become sensitive after malloc() has been initialized.
- the special handling for sensitive processes is not in RELENG_4. This is
only a bug if the special handling is not a bug.
Bruce
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040218140756.S20006>